cargdev/angular
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): trust resource URLs as URLs. (#10220)

Browse Source 
Resource URLs are strictly "more" trustworthy than plain URLs, so trusting them maintains the same level of security while avoiding to break people when we downgrade a resource URL context to a plain URL context.
This commit is contained in:
Martin Probst
2016-07-21 17:44:59 -07:00
committed by Victor Berchet
parent 00aa7a76b6
commit 51f3d22e4f
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/@angular/platform-browser/src/security/dom_sanitization_service.ts
View File

@ -165,7 +165,10 @@ export class DomSanitizationServiceImpl extends DomSanitizationService {
this.checkNotSafeValue(value, 'Script');
throw new Error('unsafe value used in a script context');
case SecurityContext.URL:
if (value instanceof SafeUrlImpl) return value.changingThisBreaksApplicationSecurity;
if (value instanceof SafeResourceUrlImpl || value instanceof SafeUrlImpl) {
// Allow resource URLs in URL contexts, they are strictly more trusted.
return value.changingThisBreaksApplicationSecurity;
}
this.checkNotSafeValue(value, 'URL');
return sanitizeUrl(String(value));
case SecurityContext.RESOURCE_URL: